WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
WPC Smart Upsell Funnel for WooCommerce <= 3.0.4 - Authenticated (Subscriber+) Arbitrary Options Update
8.8
CVE-2025-30772
Mar 27, 2025
Researcher: LVT-tholv2k
EO4WP <= 1.0.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30763
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Analytify <= 5.5.1 - Missing Authorization to Authenticated (Subscriber+) Minor Settings Update
4.3
CVE-2025-30897
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
xili-dictionary <= 2.12.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-30840
Mar 27, 2025
Researcher: 0xd4rk5id3
Nmedia MailChimp <= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2025-30613
Mar 27, 2025
Researcher: Skalucy
Cart tracking for WooCommerce <= 1.0.16 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-30791
Mar 27, 2025
Researcher: kuteminh11
LearnPress <= 4.2.7.5 - Missing Authorization
5.3
CVE-2025-22739
Mar 27, 2025
Researcher: David Ojeda Guijarro
WP2LEADS <= 3.4.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-30827
Mar 27, 2025
Researcher: johska
JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion
9.1
CVE-2025-30878
Mar 27, 2025
Researcher: LVT-tholv2k
reCAPTCHA for all <= 2.22 - Cross-Site Request Forgery
4.3
CVE-2025-30862
Mar 27, 2025
Researcher: Skalucy
The Post Grid <= 7.7.17 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-30814
Mar 27, 2025
Researcher: LVT-tholv2k
Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30860
Mar 27, 2025
Researcher: Muhammad Yudha - DJ
IP Locator <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30826
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Product Author for WooCommerce <= 1.0.7 - Cross-Site Request Forgery
4.3
CVE-2025-30872
Mar 27, 2025
Researcher: Nguyen Xuan Chien
bizcalendar-web <= 1.1.0.34 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-30843
Mar 27, 2025
Researcher: Phan Trong Quan
jAlbum Bridge <= 2.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30818
Mar 27, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-30845
Mar 27, 2025
Researcher: LVT-tholv2k
Ads by WPQuads <= 2.0.87.1 - Missing Authorization
5.3
CVE-2025-30855
Mar 27, 2025
Researcher: astra.r3verii
Float menu <= 6.1.2 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2025-30912
Mar 27, 2025
Researcher: Khang Duong
Five Star Restaurant Reservations <= 2.6.29 - Missing Authorization
4.3
CVE-2025-30861
Mar 27, 2025
Researcher: Revan Arifio
Title CVE ID CVSS Researchers Date
WPC Smart Upsell Funnel for WooCommerce <= 3.0.4 - Authenticated (Subscriber+) Arbitrary Options Update CVE-2025-30772 8.8 LVT-tholv2k March 27, 2025
EO4WP <= 1.0.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30763 6.4 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
Analytify <= 5.5.1 - Missing Authorization to Authenticated (Subscriber+) Minor Settings Update CVE-2025-30897 4.3 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
xili-dictionary <= 2.12.5 - Reflected Cross-Site Scripting CVE-2025-30840 6.1 0xd4rk5id3 March 27, 2025
Nmedia MailChimp <= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2025-30613 6.4 Skalucy March 27, 2025
Cart tracking for WooCommerce <= 1.0.16 - Authenticated (Administrator+) SQL Injection CVE-2025-30791 4.9 kuteminh11 March 27, 2025
LearnPress <= 4.2.7.5 - Missing Authorization CVE-2025-22739 5.3 David Ojeda Guijarro March 27, 2025
WP2LEADS <= 3.4.5 - Reflected Cross-Site Scripting CVE-2025-30827 6.1 johska March 27, 2025
JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion CVE-2025-30878 9.1 LVT-tholv2k March 27, 2025
reCAPTCHA for all <= 2.22 - Cross-Site Request Forgery CVE-2025-30862 4.3 Skalucy March 27, 2025
The Post Grid <= 7.7.17 - Authenticated (Contributor+) Local File Inclusion CVE-2025-30814 8.8 LVT-tholv2k March 27, 2025
Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30860 6.4 Muhammad Yudha - DJ March 27, 2025
IP Locator <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30826 6.4 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
Product Author for WooCommerce <= 1.0.7 - Cross-Site Request Forgery CVE-2025-30872 4.3 Nguyen Xuan Chien March 27, 2025
bizcalendar-web <= 1.1.0.34 - Authenticated (Administrator+) SQL Injection CVE-2025-30843 4.9 Phan Trong Quan March 27, 2025
jAlbum Bridge <= 2.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-30818 6.4 Trương Hữu Phúc (truonghuuphuc) March 27, 2025
The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Local File Inclusion CVE-2025-30845 8.8 LVT-tholv2k March 27, 2025
Ads by WPQuads <= 2.0.87.1 - Missing Authorization CVE-2025-30855 5.3 astra.r3verii March 27, 2025
Float menu <= 6.1.2 - Cross-Site Request Forgery to Settings Update CVE-2025-30912 4.3 Khang Duong March 27, 2025
Five Star Restaurant Reservations <= 2.6.29 - Missing Authorization CVE-2025-30861 4.3 Revan Arifio March 27, 2025
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 5, 2026
Vulns
1 Ananda Dhakal 75
2 Wordfence PRISM 65
3 Karthik Ramakrishnan 34
4 Jakub Herman 30
5 Artus KG 30
6 Intrudify 20
7 daroo 19
8 nh4tvd 17
9 Kuba 14
10 Erwan LR 14
11 Pablo González Pérez 14
12 Francisco José Ramírez Vicente 14
13 Dmitrii Ignatyev 14
14 Iñigo Sánchez Enciso 14
15 h0xilo 13
16 vuxvinh 12
17 Revanth Hari Narayana Matte 12
18 Charles Vosburgh 12
19 Supakiad S. (m3ez) 12
20 Pedro Pinho 12

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation